TechBlog

Looking at a random new incoming malware sample in F-Secure sample automation systems. Notice the Mutex names it uses: Hey STFU yourself, why don’t you? P.S. It’s detected as Email-Worm:MSIL/Agent.MXK

The spammers and malware authors profited of the holiday time when a lot of people are at home and sent a large amount of emails just before the official free days. As can be seen in the graphic below, we registered a higher activity in the two days before the holidays and immediately after them. The red bars are either weekend days or holidays (25.12 and 1.1). What kind of spam was sent? ...

I received an interesting IM from a friend via BlackBerry Messenger [BBM] this weekend. She was worried that it could do damage to her shiny new BlackBerry and, as she knew I work for [a security company], she forwarded it to me for my opinion. As soon as I read it, I knew it was a hoax and told her just to delete it. It didn’t really surprise me that these Hoaxes are now being spread via BBM as the devices are becoming increasingly popular. I’m sure all of you have received the usual one via E-mail about a Virus which burns the whole hard disc C of your computer , well now I believe you will be seeing them on your BlackBerry. ...

Malware authors love to innovate when it comes to persistence and hiding their nefarious creations from detection, and although most of the schemes are not unknown to analysts, they still show that malware authors are constantly on the prowl and evolving their techniques. The example I have is of yet another registry-centric malware which by the nature of its construction has several advantages to defeating naive security software. The sample, detected as Troj/RegExec-A, is essentially a multi-component threat of sorts comprising of at least 3 components (Dropper/installer, Payload and Loader.) ...

Guard Pro is a rogue antispyware software, or a phony. Guard Pro uses fake system scans and warnings to frighten people into buying the software. Guard Pro will show system scan results that report numerous infections, which are all fake, and will not remove the supposed infections until the user buys the product. Do not fall for this, it is a complete scam, Guard Pro is the infection itself. Guard Pro will also show system warnings and alerts stating the PC is infected or under attack and prompts the user to buy the software. ...

Angelina Jolie and Barack Obama are the #1 celeb subjects of choice for spammers, according to McAfee January Spam Report. The report also reveals: • The top 25 men and women that were spammed • Chinese pharma spam isn’t going away – in fact, on Dec 14, spam levels skyrocketed with subject lines advertising discounts on Pfizer drugs • “Free-hosting” websites to provide spam URLs has become a major target for spammers ...

Google’s Android mobile operating system has been out for a while and is generating more and more interest. Now there has been some buzz about fraudulent applications being posted on the Android Market. See these postings: Both of these apps were written by an anonymous developer known as 09Droid. In fact, he had a whole collection of online banking applications for sale on the Market: ...

The Internet Storm Center reports that malware which claims to be “new Outlook Web Access settings” is still being sent out by cyber criminals. We saw those malware emails in the middle of October already.

InSysSecure is a rogue security program, designed to rip people off. InSysSecure uses false security warnings, alerts and system scans to frighten people into thinking their computer systems are infected, all the while InSysSecure is the actual infection. if your system is infected with above malware, you should remove it soon, Click Here to learn how to remove it.

Unlike the first malware authors who wrote viruses seeking fame through destruction, their motivation has changed to financial gain. Nevertheless, there are still the ones out there who share the first authors’ intent. I was analysing a simple Trojan today and saw the following message: It is not uncommon for malware authors to leave messages in their code for Researchers to read. This one did bring a smile to my face, so he was rewarded by it being named BackDoor-EKD which is an increment of one from BackDoor-EKC 😉